August 27, 2026 · by Alex M.
WireGuard is one of the most modern and efficient VPN protocols available today. Unlike OpenVPN or IPsec, WireGuard has an extremely compact codebase (~4,000 lines of code), making it fast, easy to audit, and secure. If you have a SSD VPS or an NVMe VPS, you can turn your server into a private VPN tunnel in less than 30 minutes.
In this guide you will learn how to install WireGuard on Ubuntu 22.04, configure the server and a client, and route all traffic through the VPN.
Before diving into installation, here are some concrete reasons why WireGuard is gaining ground rapidly:
If you're running a 1 vCore VPS for a personal project, WireGuard is an excellent choice — minimal resource consumption, maximum security.
Before you begin, make sure you have:
EN
RO — Română
RU — Русский
sudo privilegesIf you don't have a server yet, you can order an SSD VPS from CLIQHOST and be ready within minutes.
Connect to your server via SSH, then run:
sudo apt update && sudo apt upgrade -y
sudo apt install wireguard -y
Verify that the kernel module is available:
modinfo wireguard
You should see information about the WireGuard module. If not, on older kernels:
sudo apt install linux-headers-$(uname -r) wireguard-dkms -y
WireGuard relies on a private/public key pair for each peer (server and client).
On the server:
cd /etc/wireguard
wg genkey | tee server_private.key | wg pubkey > server_public.key
chmod 600 server_private.key
cat server_private.key
cat server_public.key
Note both values — you will use them in the configuration files.
On your client (local machine or another VPS):
wg genkey | tee client_private.key | wg pubkey > client_public.key
cat client_private.key
cat client_public.key
Create the server configuration file:
sudo nano /etc/wireguard/wg0.conf
Content (replace values with your actual keys):
[Interface]
Address = 10.0.0.1/24
ListenPort = 51820
PrivateKey = <server_private_key>
# Enable traffic forwarding (NAT)
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
[Peer]
PublicKey = <client_public_key>
AllowedIPs = 10.0.0.2/32
Note: Replace
eth0with your actual network interface (check withip a).
For the server to route VPN client traffic to the internet, you must enable IP forwarding:
sudo nano /etc/sysctl.conf
Uncomment or add the line:
net.ipv4.ip_forward = 1
Apply immediately:
sudo sysctl -p
sudo systemctl enable wg-quick@wg0
sudo systemctl start wg-quick@wg0
sudo systemctl status wg-quick@wg0
Verify the active interface:
sudo wg show
You should see the wg0 interface with the listening port and the peer list.
If you use UFW on your server (recommended), allow the WireGuard port:
sudo ufw allow 51820/udp
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status
For additional server security tips, visit the CLIQHOST blog where you'll find practical guides on UFW, iptables, and other tools.
On the client device (Linux, Windows, macOS, Android, iOS — WireGuard has clients for all platforms), create the configuration file:
[Interface]
Address = 10.0.0.2/24
PrivateKey = <client_private_key>
DNS = 1.1.1.1
[Peer]
PublicKey = <server_public_key>
Endpoint = <SERVER_PUBLIC_IP>:51820
AllowedIPs = 0.0.0.0/0
PersistentKeepalive = 25
The value AllowedIPs = 0.0.0.0/0 means that all traffic from the client will be routed through the VPN. If you only want access to the private network (without routing all traffic), use AllowedIPs = 10.0.0.0/24.
On Linux, start the client connection:
sudo wg-quick up wg0
Check your public IP (it should match your VPS's IP):
curl ifconfig.me
WireGuard supports multiple peers simultaneously. For each new client:
[Peer] section to /etc/wireguard/wg0.conf on the server:[Peer]
PublicKey = <client2_public_key>
AllowedIPs = 10.0.0.3/32
sudo wg syncconf wg0 <(wg-quick strip wg0)
This command applies changes live, without a restart.
sudo ufw status).Endpoint is correct.sudo journalctl -u wg-quick@wg0 -fnet.ipv4.ip_forward = 1 is active: sysctl net.ipv4.ip_forwardiptables -L -n -v and iptables -t nat -L -n -v.PostUp/PostDown (eth0) matches the real one.If you're using the VPN to access internal services, round out your infrastructure with an SSL certificate for publicly exposed services. If you lack extensive DevOps experience, consider professional server management to keep everything running smoothly.
For more demanding projects, a managed dedicated server provides the resources and support needed for a large-scale VPN infrastructure.
WireGuard is the ideal VPN solution for users who want simplicity, speed, and modern security on a Linux VPS. With fewer than 20 commands, you'll have a fully functional VPN tunnel that can protect your entire online activity or securely interconnect private networks.
If you don't have a server yet, CLIQHOST offers SSD and NVMe VPS plans with 1 Gbps ports, a dedicated IP, and root access immediately after ordering. Contact us for any questions about configuration or choosing the right plan.
Real reviews from customers who trust CLIQHOST for performance, reliability and expert technical support.
"We moved our online shop from a foreign host and the difference is night and day — pages load instantly and support replies in minutes, in Romanian."
"Migrated 12 client sites to CLIQHOST. Free migration, zero downtime, and the cPanel setup is exactly what my team needed. Highly recommend."
"Our NVMe VPS handles traffic spikes without a sweat. Full root, local datacenter, and billing in MDL — everything we wanted from a provider."
